rixleys 1.0.0

package/lib/Signal/Group/sender-key-name.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SenderKeyName = void 0;
+function isNull(str) {
+    return str === null || str === '';
+}
+function intValue(num) {
+    const MAX_VALUE = 0x7fffffff;
+    const MIN_VALUE = -0x80000000;
+    if (num > MAX_VALUE || num < MIN_VALUE) {
+        return num & 0xffffffff;
+    }
+    return num;
+}
+function hashCode(strKey) {
+    let hash = 0;
+    if (!isNull(strKey)) {
+        for (let i = 0; i < strKey.length; i++) {
+            hash = hash * 31 + strKey.charCodeAt(i);
+            hash = intValue(hash);
+        }
+    }
+    return hash;
+}
+class SenderKeyName {
+    constructor(groupId, sender) {
+        this.groupId = groupId;
+        this.sender = sender;
+    }
+    getGroupId() {
+        return this.groupId;
+    }
+    getSender() {
+        return this.sender;
+    }
+    serialize() {
+        return `${this.groupId}::${this.sender.id}::${this.sender.deviceId}`;
+    }
+    toString() {
+        return this.serialize();
+    }
+    equals(other) {
+        if (other === null)
+            return false;
+        return this.groupId === other.groupId && this.sender.toString() === other.sender.toString();
+    }
+    hashCode() {
+        return hashCode(this.groupId) ^ hashCode(this.sender.toString());
+    }
+}
+exports.SenderKeyName = SenderKeyName;

package/lib/Signal/Group/sender-key-record.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SenderKeyRecord = void 0;
+const generics_1 = require("../../Utils/generics");
+const sender_key_state_1 = require("./sender-key-state");
+class SenderKeyRecord {
+    constructor(serialized) {
+        this.MAX_STATES = 5;
+        this.senderKeyStates = [];
+        if (serialized) {
+            for (const structure of serialized) {
+                this.senderKeyStates.push(new sender_key_state_1.SenderKeyState(null, null, null, null, null, null, structure));
+            }
+        }
+    }
+    isEmpty() {
+        return this.senderKeyStates.length === 0;
+    }
+    getSenderKeyState(keyId) {
+        if (keyId === undefined && this.senderKeyStates.length) {
+            return this.senderKeyStates[this.senderKeyStates.length - 1];
+        }
+        return this.senderKeyStates.find(state => state.getKeyId() === keyId);
+    }
+    addSenderKeyState(id, iteration, chainKey, signatureKey) {
+        this.senderKeyStates.push(new sender_key_state_1.SenderKeyState(id, iteration, chainKey, null, signatureKey));
+        if (this.senderKeyStates.length > this.MAX_STATES) {
+            this.senderKeyStates.shift();
+        }
+    }
+    setSenderKeyState(id, iteration, chainKey, keyPair) {
+        this.senderKeyStates.length = 0;
+        this.senderKeyStates.push(new sender_key_state_1.SenderKeyState(id, iteration, chainKey, keyPair));
+    }
+    serialize() {
+        return this.senderKeyStates.map(state => state.getStructure());
+    }
+    static deserialize(data) {
+        let parsed;
+        if (typeof data === 'string') {
+            parsed = JSON.parse(data, generics_1.BufferJSON.reviver);
+        }
+        else if (data instanceof Uint8Array) {
+            const str = Buffer.from(data).toString('utf-8');
+            parsed = JSON.parse(str, generics_1.BufferJSON.reviver);
+        }
+        else {
+            parsed = data;
+        }
+        return new SenderKeyRecord(parsed);
+    }
+}
+exports.SenderKeyRecord = SenderKeyRecord;

package/lib/Signal/Group/sender-key-state.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SenderKeyState = void 0;
+const sender_chain_key_1 = require("./sender-chain-key");
+const sender_message_key_1 = require("./sender-message-key");
+class SenderKeyState {
+    constructor(id, iteration, chainKey, signatureKeyPair, signatureKeyPublic, signatureKeyPrivate, senderKeyStateStructure) {
+        this.MAX_MESSAGE_KEYS = 2000;
+        if (senderKeyStateStructure) {
+            this.senderKeyStateStructure = senderKeyStateStructure;
+        }
+        else {
+            if (signatureKeyPair) {
+                signatureKeyPublic = signatureKeyPair.public;
+                signatureKeyPrivate = signatureKeyPair.private;
+            }
+            chainKey = typeof chainKey === 'string' ? Buffer.from(chainKey, 'base64') : chainKey;
+            const senderChainKeyStructure = {
+                iteration: iteration || 0,
+                seed: chainKey || Buffer.alloc(0)
+            };
+            const signingKeyStructure = {
+                public: typeof signatureKeyPublic === 'string'
+                    ? Buffer.from(signatureKeyPublic, 'base64')
+                    : signatureKeyPublic || Buffer.alloc(0)
+            };
+            if (signatureKeyPrivate) {
+                signingKeyStructure.private =
+                    typeof signatureKeyPrivate === 'string' ? Buffer.from(signatureKeyPrivate, 'base64') : signatureKeyPrivate;
+            }
+            this.senderKeyStateStructure = {
+                senderKeyId: id || 0,
+                senderChainKey: senderChainKeyStructure,
+                senderSigningKey: signingKeyStructure,
+                senderMessageKeys: []
+            };
+        }
+    }
+    getKeyId() {
+        return this.senderKeyStateStructure.senderKeyId;
+    }
+    getSenderChainKey() {
+        return new sender_chain_key_1.SenderChainKey(this.senderKeyStateStructure.senderChainKey.iteration, this.senderKeyStateStructure.senderChainKey.seed);
+    }
+    setSenderChainKey(chainKey) {
+        this.senderKeyStateStructure.senderChainKey = {
+            iteration: chainKey.getIteration(),
+            seed: chainKey.getSeed()
+        };
+    }
+    getSigningKeyPublic() {
+        const publicKey = this.senderKeyStateStructure.senderSigningKey.public;
+        if (publicKey instanceof Buffer) {
+            return publicKey;
+        }
+        else if (typeof publicKey === 'string') {
+            return Buffer.from(publicKey, 'base64');
+        }
+        return Buffer.from(publicKey || []);
+    }
+    getSigningKeyPrivate() {
+        const privateKey = this.senderKeyStateStructure.senderSigningKey.private;
+        if (!privateKey) {
+            return undefined;
+        }
+        if (privateKey instanceof Buffer) {
+            return privateKey;
+        }
+        else if (typeof privateKey === 'string') {
+            return Buffer.from(privateKey, 'base64');
+        }
+        return Buffer.from(privateKey || []);
+    }
+    hasSenderMessageKey(iteration) {
+        return this.senderKeyStateStructure.senderMessageKeys.some(key => key.iteration === iteration);
+    }
+    addSenderMessageKey(senderMessageKey) {
+        this.senderKeyStateStructure.senderMessageKeys.push({
+            iteration: senderMessageKey.getIteration(),
+            seed: senderMessageKey.getSeed()
+        });
+        if (this.senderKeyStateStructure.senderMessageKeys.length > this.MAX_MESSAGE_KEYS) {
+            this.senderKeyStateStructure.senderMessageKeys.shift();
+        }
+    }
+    removeSenderMessageKey(iteration) {
+        const index = this.senderKeyStateStructure.senderMessageKeys.findIndex(key => key.iteration === iteration);
+        if (index !== -1) {
+            const messageKey = this.senderKeyStateStructure.senderMessageKeys[index];
+            this.senderKeyStateStructure.senderMessageKeys.splice(index, 1);
+            return new sender_message_key_1.SenderMessageKey(messageKey.iteration, messageKey.seed);
+        }
+        return null;
+    }
+    getStructure() {
+        return this.senderKeyStateStructure;
+    }
+}
+exports.SenderKeyState = SenderKeyState;

package/lib/Signal/Group/sender-message-key.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SenderMessageKey = void 0;
+const crypto_1 = require("libsignal/src/crypto");
+class SenderMessageKey {
+    constructor(iteration, seed) {
+        const derivative = (0, crypto_1.deriveSecrets)(seed, Buffer.alloc(32), Buffer.from('WhisperGroup'));
+        const keys = new Uint8Array(32);
+        keys.set(new Uint8Array(derivative[0].slice(16)));
+        keys.set(new Uint8Array(derivative[1].slice(0, 16)), 16);
+        this.iv = Buffer.from(derivative[0].slice(0, 16));
+        this.cipherKey = Buffer.from(keys.buffer);
+        this.iteration = iteration;
+        this.seed = seed;
+    }
+    getIteration() {
+        return this.iteration;
+    }
+    getIv() {
+        return this.iv;
+    }
+    getCipherKey() {
+        return this.cipherKey;
+    }
+    getSeed() {
+        return this.seed;
+    }
+}
+exports.SenderMessageKey = SenderMessageKey;

package/lib/Signal/core/.eslintrc.json

@@ -0,0 +1,31 @@
+{
+    "parserOptions": {
+        "ecmaVersion": 8
+    },
+    "env": {
+        "es6": true,
+        "node": true
+    },
+    "extends": "eslint:recommended",
+    "rules": {
+        "quotes": "off",
+        "semi": [
+            "error",
+            "always"
+        ],
+        "no-console": "off",
+        "no-debugger": "off",
+        "no-unused-vars": [
+            "error",
+            {
+                "args": "none"
+            }
+        ],
+        "no-constant-condition": [
+            "error",
+            {
+                "checkLoops": false
+            }
+        ]
+    }
+}

package/lib/Signal/core/CODE_OF_CONDUCT.md

@@ -0,0 +1,102 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in the libsignal-node community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+- Sexualized language or imagery, or sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Project-Specific Conduct
+
+`libsignal-node` is a cryptographic library. The cost of a bad change here is high: it's not "a feature breaks for one user," it's "every downstream Signal-Protocol application weakens or breaks session state for every account they manage." Contributions are held to a corresponding standard.
+
+Contributions that fall into the following categories will be rejected:
+
+- **Weakening crypto.** Replacing primitives, lowering iteration counts, swapping a constant-time comparison for a non-constant-time one, removing MAC checks, accepting unauthenticated payloads, or "optimizing" away anything that looks like a defensive check. If the goal of a change is to make the protocol *do less*, it needs a security review, not a merge.
+- **Adding backdoors, key escrow, or "debug" modes that bypass authentication.** This is not negotiable, including under the framing of "but it's only on by default in development."
+- **Breaking on-disk session formats without a migration story.** Downstream users have persisted state. Changes to serialization need explicit handling, not silent breakage.
+- **Bypassing the Signal Protocol's intended properties** (forward secrecy, post-compromise security, deniability) for convenience — e.g., disabling ratchet stepping, persisting old chain keys, or logging plaintext into the store.
+
+Discussion of these areas — *understanding* why a check exists, *proposing* a safer alternative, *fixing* a bug that happens to touch them — is welcome and necessary. The line is intent.
+
+## AI Policy
+
+This project welcomes AI-assisted contributions. Most of us use them. For a cryptographic library, the rules are stricter than usual:
+
+1. **You are the author.** AI tools (Claude, Copilot, Cursor, Codex, ChatGPT, etc.) are tools. The human who opens the PR is responsible for every line in it — correctness, license compatibility, security implications, and adherence to the rest of this Code of Conduct. "The AI wrote it" is not a defense, and it's an especially weak one for crypto code.
+
+2. **Disclose AI use in PRs.** A one-line note in the PR description is enough — for example: *"Drafted with Claude Code, reviewed and tested by me."* You don't need to enumerate every prompt. The point is that reviewers know to look closer at things AI tools commonly get wrong (hallucinated APIs, invented protocol details, plausible-but-wrong refactors).
+
+3. **Review before you submit.** Don't open PRs with code you haven't read. Don't open PRs with code you don't understand well enough to defend in review. If a reviewer asks "why does this work?" and your answer is "the AI suggested it," the PR will be closed.
+
+4. **Test what the AI produced.** Run the test suite locally. AI tools confidently generate code that doesn't compile, doesn't pass existing tests, or — worse for this project — passes tests but quietly breaks an invariant the tests don't cover.
+
+5. **Don't paste secrets into AI tools.** This includes:
+   - Identity keys, signed prekeys, one-time prekeys, sender keys, sessions — any contents of a real `SignalProtocolStore`
+   - `.env` files, API tokens, signing keys
+   - Real user phone numbers, message content, or contact lists from production systems
+   Most AI providers retain prompts for some period; treat anything you paste as published.
+
+6. **Don't use AI to mass-generate issues, PRs, or comments.** Drive-by AI-generated PRs that "fix" non-bugs, add unnecessary tests, or reformat unrelated code waste maintainer time and will be closed without detailed review. If you're using an autonomous agent, supervise it — especially anywhere near crypto code.
+
+7. **Hallucinated protocol details are a security issue.** The Signal Protocol has a specific definition. AI tools will confidently invent ratchet behavior, key-derivation orderings, message-keys structures, and serialization layouts that look plausible and are wrong. Verify against the upstream Signal specification, the existing test vectors, or a known-good implementation before submitting anything that touches the protocol state machine.
+
+8. **License-compatible output only.** If you use an AI tool that may surface code from incompatible licenses (proprietary, or licenses incompatible with GPL-3.0), don't submit that output. We can't accept it. `libsignal-node` is GPL-3.0.
+
+Following this policy doesn't slow you down — it just keeps the bar consistent between AI-assisted and hand-written contributions.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers at **rajeh@reforward.dev**. All complaints will be reviewed and investigated promptly and fairly. The maintainers are obligated to respect the privacy and security of the reporter of any incident.
+
+For security vulnerabilities (which are not Code of Conduct issues), see **[SECURITY.md](SECURITY.md)**.
+
+## Enforcement Guidelines
+
+Maintainers will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact:** Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence:** A private, written warning from the maintainers, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact:** A violation through a single incident or series of actions.
+
+**Consequence:** A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact:** A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence:** A temporary ban from any sort of interaction or public communication with the community for a specified period of time. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact:** Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. Also: contributions or behavior aimed at weakening the cryptographic guarantees of the library (see § Project-Specific Conduct).
+
+**Consequence:** A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1, with project-specific and AI-policy sections added by the maintainers of `libsignal-node`.